Networks

Question

in-addr.arpa reverse

Hi, can someone explain in laymans terms how in-addr.arpa reverse works locally for DNS queries (inverse) and then non local DNS servers. How would I set-up the above in DNS if I wish to have my local DNS server able to handle inverse queries correctly? I am relatively new to this in DNS and would appreciate any advice, help or even better experience of the above. Cheers D

All Answers

Reverse DNS

Reverse DNS turns an IP address into a hostname -- for example, it might turn 192.0.2.25 into host.example.com.

For your domains, standard DNS (turning a hostname into an IP address, such turning host.example.com into 192.0.2.25) starts with the company (registrar) that you registered your domains with. You let them know what DNS servers are responsible for your domain names, and the registrar sends this information to the root servers (technically, the parent servers for your TLD). Then, anyone in the world can access your domains, and you can send them to any IP addresses you want. You have full control over your domains, and can send people to any IPs (whether or not you have control over those IPs, although you should have permission to send them to IPs that are not yours).

Reverse DNS works in a similar method. For your IPs, reverse DNS (turning 192.0.2.25 back into host.example.com) starts with your ISP (or whoever told you what your IP addresses are). You let them know what DNS servers are responsible for the reverse DNS entries for your IPs (or, they can enter the reverse DNS entries on their DNS servers), and your ISP gives this information out when their DNS servers get queried for your reverse DNS entries. Then, anyone in the world can look up the reverse DNS entries for your IPs, and you can return any hostnames you want (whether or not you have control over those domains, although you should have permission to point them to hostnames that are not on your domains).

So for both standard DNS and reverse DNS, there are two steps: [1] You need DNS servers, and [2] You need to tell the right company (your registrar for standard DNS lookups, or your ISP for reverse DNS lookups) where your DNS servers are located. Without Step 2, nobody will be able to reach your DNS servers.

If you can comprehend the above paragraphs (which takes some time), you'll understand the biggest problem that people have with reverse DNS entries. The biggest problem people have is that they have DNS servers that work fine with their domains (standard DNS), they add reverse DNS entries to those servers, and it doesn't work. If you understand the above paragraphs, you'll see the problem: If your ISP doesn't know that you have DNS servers to handle the reverse DNS for your IPs, they won't send that information to the root servers, and nobody will even get to your DNS servers for reverse DNS looksups.

Basic Concepts: Reverse DNS turns 192.0.2.25 into host.example.com (an IP address into a host name). Typical reverse DNS lookup path: DNS resolver => root servers => ARIN (North American IP registry) => Local ISP => Acme Inc. DNS servers. Whoever supplies your IP addresses (usually your ISP) MUST either [1] set up your reverse DNS entries on their DNS servers, or [2] "delegate authority" for your reverse DNS entries to your DNS servers. Reverse DNS entries use a host name with a reversed IP address with ".in-addr.arpa" added to it -- for example, "25.2.0.192.in-addr.arpa". Reverse DNS entries are set up with PTR records (whereas standard DNS uses A records), which look like "25.2.0.192.in-addr.arpa. PTR host.example.com" (whereas standard DNS would look like "host.example.com. A 192.0.2.25"). All Internet hosts should have a reverse DNS entry (see RFC1**2 section 2.1). Mail servers with no reverse DNS will have a hard time getting mail to certain large ISPs. Very Common Myth: Myth: If you have a reverse DNS entry listed in your DNS server, you have reverse DNS properly set up. Fact: This is often not the case. You need TWO things in order to have your DNS set up properly: 1. Your DNS servers (or your ISP's) MUST have the reverse DNS entries set up ("25.2.0.192.in-addr.arpa. PTR host.example.com"). 2. AND your ISP or bandwidth provider MUST set up the reverse DNS on their end, so that DNS resolvers around the world will know that your DNS servers are the ones to go to when looking up the reverse DNS for your IP addresses. How a reverse DNS lookup is accomplished: The DNS resolver reverses the IP, and adds it to ".in-addr.arpa", turning 192.0.2.25 into 25.2.0.192.in-addr.arpa. The DNS resolver then looks up the PTR record for 25.2.0.192.in-addr.arpa. The DNS resolver checks asks the root servers for the PTR record for 25.2.0.192.in-addr.arpa. The root servers refer the DNS resolver to the DNS servers in charge of the Class A range (192.in-addr.arpa, which covers all IPs that begin with 192). In almost all cases, the root servers will refer the DNS resolver to a "RIR" ("Regional Internet Registry"). These are the organizations that allocate IPs. In general, ARIN handles North American IPs, APNIC handles Asian-Pacific IPs, and RIPE handles European IPs.

The DNS resolver will ask the ARIN DNS servers for the PTR record for 25.2.0.192.in-addr.arpa. The ARIN DNS servers will refer the DNS resolver to the DNS servers of the organization that was originally given the IP range. These are usually the DNS servers of your ISP, or their bandwidth provider.

The DNS resolver will ask the ISP's DNS servers for the PTR record for 25.0.2.192.in-addr.arpa. The ISP's DNS servers will refer the DNS resolver to the organization's DNS servers.

The DNS resolver will ask the organization's DNS servers for the PTR record for 25.0.2.192.in-addr.arpa. The organization's DNS servers will respond with "host.example.com".

one more things that puzzles me

Can anyone explain why I can see the loop back address 127.0.0.1 revearse lookup (1.0.0.127.in-addr.arpa.address) but not my own local ipaddress reversed when I dodisplaydns as per below...thanks again Dee

Start or search

Create a new discussion

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

Post type

Subject title

Topic Tags

Select up to 3 tags (1 tag required)

Cloud

Piracy

Security

Apple

Microsoft

IT Employment

Google

Open Source

Mobility

Social Enterprise

Community

Smartphones

Operating Systems

Windows

Mac

Malware

Tablets

Networking

Browser

Hardware

Software

Web Developerment

Linux

Off Topic

Message Body

Track this discussion and email me when there are updates

Please note: Do not post advertisements, offensive material, profanity, or personal attacks. Please remember to be considerate of other members. If you're new to the TechRepublic Forums, please read our TechRepublic Forums FAQ. All submitted content is subject to our Terms Of Use.